CVE-2026-126074

Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Filename#base and #extension_with_delimiter, and therefore #extension, pass the stored filename unmodified to File.basename and File.extname, which raise ArgumentError when the name contains a NUL byte. Active Storage stores the client-supplied filename verbatim, so a user who is permitted to upload an attachment could persist such a filename on databases that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. Each subsequent request that builds a variant or preview of the blob, opens it, or renders it as an Action Text attachment then raises, possibly resulting in a persistent DoS vulnerability for the pages that display the blob until it is purged or its filename is corrected. Applications that use PostgreSQL are not affected, because PostgreSQL rejects the row. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

• CWE-248

• https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692
• https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a
• https://github.com/rails/rails/releases/tag/v8.0.5.2
• https://github.com/rails/rails/releases/tag/v8.1.4.1
• https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j

Published

Nov 10, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-126068Action Mailbox routes incoming emails to controller-like mai…3.7
• CVE-2026-126069Action View is a framework for handling view template lookup…4.7
• CVE-2026-126070Action View is a framework for handling view template lookup…6.1
• CVE-2026-126071Active Storage makes it simple to upload and reference files…5.3
• CVE-2026-126072Action Pack is a framework for handling and responding to we…5.9
• CVE-2026-126073Action Pack is a framework for handling and responding to we…4.8
• CVE-2026-126075Active Support is a collection of utility classes and standa…4.7
• CVE-2026-126076Action Pack is a framework for handling and responding to we…4.2
• CVE-2026-126077Action Pack is a framework for handling and responding to we…6.8
• CVE-2026-126078Action View is a framework for handling view template lookup…6.1
• CVE-2026-126079Action View is a framework for handling view template lookup…6.1
• CVE-2026-126080Active Support is a collection of utility classes and standa…7.5